hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 13:45:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7740 from erik-krogh/CWE-347

Browse Source 
JS: promote the js/jwt-missing-verification query out of experimental
This commit is contained in:
Erik Krogh Kristensen
2022-02-01 13:10:35 +01:00
committed by GitHub
parent f7a0b17ed6 8dcec2e037
commit e6c90670e6
9 changed files with 78 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
javascript/ql/test/query-tests/Security/CWE-347/MissingJWTKeyVerification.expected Normal file
View File

@@ -0,0 +1,3 @@
| bad-jwt.js:10:19:10:20 | "" | This argument disables the integrity enforcement of the token verification. |
| bad-jwt.js:11:19:11:27 | undefined | This argument disables the integrity enforcement of the token verification. |
| bad-jwt.js:12:19:12:23 | false | This argument disables the integrity enforcement of the token verification. |

1
javascript/ql/test/query-tests/Security/CWE-347/MissingJWTKeyVerification.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE-347/MissingJWTKeyVerification.ql

12
javascript/ql/test/query-tests/Security/CWE-347/bad-jwt.js Normal file
View File

@@ -0,0 +1,12 @@
const jwt = require("jsonwebtoken");
const secret = "my-secret-key";
var token = jwt.sign({ foo: 'bar' }, secret, { algorithm: "HS256" })
jwt.verify(token, secret, { algorithms: ["HS256", "none"] }) // OK
var token = jwt.sign({ foo: 'bar' }, secret, { algorithm: "none" })
jwt.verify(token, "", { algorithms: ["HS256", "none"] }) // NOT OK
jwt.verify(token, undefined, { algorithms: ["HS256", "none"] }) // NOT OK
jwt.verify(token, false, { algorithms: ["HS256", "none"] }) // NOT OK